CVE-2018-19205

CVE-2018-19205 affects Roundcube before 1.3.7, where processing of GnuPG MDC integrity-protection warnings in the Enigma driver (plugins/enigma/lib/enigma_driver_gnupg.php) can leak sensitive information. The issue is tied to a related CVE-2017-17688 and is mitigated by updating Roundcube to vers...

PT-2018-14861

Name of the Vulnerable Software and Affected Versions Roundcube versions prior to 1.3.7 Description The issue makes it easier for attackers to obtain sensitive information by mishandling GnuPG MDC integrity-protection warnings. This is related to the handling of encryption and decryption processe...

Roundcube Webmail < 1.3.7 Enigma Plugin PGP Vulnerability (EFAIL)

Roundcube Webmail is prone to an information disclosure vulnerability in the Enigma Plugin. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later...

Design/Logic Flaw

DISPUTED The OpenPGP specification allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code MDC feature or accept an...

UBUNTU-CVE-2017-17688

DISPUTED The OpenPGP specification allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code MDC feature or accept an...

CVE-2017-17688

The OpenPGP specification allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code MDC feature or accept an obsolete...

CVE-2017-17688

CVE-2017-17688 concerns an OpenPGP CFB gadget/malleability attack (EFAIL) that can lead to plaintext exfiltration from encrypted emails. Connected advisories show Enigmail/OpenPGP patches (e.g., openSUSE SUSE/OpenSUSE-2019-368/395; Thunderbird enigmail updates) addressing this vulnerability by ti...

CVE-2017-17688

The OpenPGP specification allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code MDC feature or accept an obsolete...

EFAIL Opens Up Encrypted Email to Prying Eyes

A set of vulnerabilities in the encryption technologies used to secure sensitive emails threatens to expose corporate communications as well as the messages of at-risk users such as journalists, political dissidents and whistleblowers operating in hostile environments. However, there is some deba...

WordPress MDC YouTube Downloader Plugin Directory Traversal Vulnerability

WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.MDC YouTube Downloader is one of the video download plugins. A path traversal vulnerability exists in version 2.1.0 of...

CVE-2015-5469

Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php...

CVE-2015-5469

Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php...

CVE-2015-5469

CVE-2015-5469 affects the WordPress MDC YouTube Downloader plugin (v2.1.0). The vulnerability is a Local File Inclusion via the file parameter to includes/download.php, enabling an attacker to read arbitrary server files through an absolute path. Impact described in sources includes potential exp...

CVE-2015-6805

Cross-site scripting XSS vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message...

Cross site scripting

Cross-site scripting XSS vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message...

CVE-2015-6805

CVE-2015-6805 (MDC Private Message plugin 1.0.0 for WordPress) is an XSS vulnerability where remote authenticated users can inject arbitrary script/HTML via the private message field. Multiple sources (NVD, CVE lists, WPVulnDB) corroborate that the flaw affects the message input and can lead to s...

CVE-2015-6805

Cross-site scripting XSS vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message...

WordPress Plugin MDC Private Message 1.0.0 - Persistent Cross-Site Scripting

Exploit Title: WordPress MDC Private Message Persistent XSS Date: 8/20/15 Exploit Author: Chris Kellum Vendor Homepage: http://medhabi.com/ https://wordpress.org/plugins/mdc-private-message/ Version: 1.0.0 ===================== Vulnerability Details ===================== The 'message' field doesn...

WordPress MDC Private Message Plugin 1.0.0 - Persistent XSS

An attacker can execute XSS issues against an administrator, because "message"field does not sanitize input. Solution Upgrade the plugin...

WordPress Plugin MDC Private Message 1.0.0 - Persistent Cross-Site Scripting

WordPress Plugin MDC Private Message 1.0.0 - Persistent Cross-Site Scripting Exploit Title: WordPress MDC Private Message Persistent XSS Date: 8/20/15 Exploit Author: Chris Kellum Vendor Homepage: http://medhabi.com/ https://wordpress.org/plugins/mdc-private-message/ Version: 1.0.0...